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Dear Sir/Madam, 


Managing ML/TF risks associated with virtual assets (VAs) and virtual asset 
service providers (VASPs) 


I am writing to provide guidance to Authorized Institutions (AIs) in relation to 
recent updates by the Financial Action Task Force (FATF) to its Recommendation 
15, which clarify the businesses and activities that the FATF requirements apply in 
the case of VAs and VASPs!. The FATF also published “Guidance for a Risk- 
Based Approach — Virtual Assets and Virtual Asset Service Providers” (the FATF 
Guidance) in June 2019, which is intended to, among others, help private sector 
entities wishing to engage in VA activities to understand and comply with their 
AML/CFT obligations. The FATF Guidance can be found at: 


https://www.fatf-gafi.org/publications/fattrecommendations/documents/guidance- 
rba-virtual-assets.html. 


FATF member jurisdictions have put in place or are implementing regulatory 
regimes for VASPs in response to the international development’. Therefore, 
increasingly there may be more VASPs which are licensed or registered in Hong 
Kong or other jurisdictions, and subject to AML/CFT regulation and supervision 
in line with the FATF Recommendations. Some VASPs may be in the process of 
applying for licensing or registration. 


Following the risk-based approach, when Als establish and maintain business 
relationships with VASPs, appropriate risk assessments’ should be conducted to 
differentiate the risks of individual VASPs, recognising that there is no “one-size- 
fits-all”. Depending on the nature of relationship, Als may undertake additional 


' Please refer to the definitions of VAs and VASPs in the FATF Glossary. 

* For example, the Securities and Futures Commission has recently announced a framework allowing 
a VA trading platform operator to opt-in to its regulation. 

The FATF Guidance provides examples of risk indicators that can be specifically considered in the 
VA context. 
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customer due diligence measures f, including the collection of sufficient 
information to adequately understand the nature of the VASP’s business; 
determining from publicly available information whether the VASP are licensed or 
registered, and subject to AML/CFT supervision; and assessing the AML/CFT 
controls of the VASP as appropriate. The extent of customer due diligence 
measures should be commensurate with the assessed ML/TF risks of the VASP. 


Besides, globally there is an emerging range of new products and services 
involving VA. In line with the FATF standards, before an AI offers any new 
banking or investment products relating to VAs, it should undertake ML/TF risk 
assessment and take appropriate measures to manage and mitigate the identified 
risks in accordance with applicable legal and regulatory requirements including 
paragraph 2.11 of the Guideline on Anti-Money Laundering and Counter- 
Financing of Terrorism (For Authorized Institutions). 


The HKMA will continue to participate in international discussions on this fast 
evolving subject matter and share updates of FATF’s work relating to VAs and 
VASPs with the banking sector from time to time. Als should keep abreast of 
international and local developments to maintain an up-to-date understanding of 
risks, and apply a risk-based approach that supports responsible financial 
innovation as well as effective ML/TF risk management. 


This circular supersedes the letters on “Risks associated with virtual commodities” 
issued on 9 January and 30 April 2014 respectively. For questions relating to this 
circular, please send to aml @hkma.iclnet.hk . 


Yours faithfully, 


Carmen Chu 
Executive Director (Enforcement and AML) 


+ Reference should be made to Chapter 11 of the Guideline on Anti-Money Laundering and Counter- 


Financing of Terrorism (For Authorized Institutions) on “Correspondent Banking and Other Similar 
Relationships”. 


